Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2af1a88f authored by Tianjie Xu's avatar Tianjie Xu Committed by android-build-merger
Browse files

Fix out of bound access in libziparchive am: 1ee4892e am: c24dd976 am:... 

Fix out of bound access in libziparchive am: 1ee4892e am: c24dd976 am: 87885912 am: 167562aa am: 398adf9b am: 680c3f1d am: f0ce6981
am: 6fb68bb1

Change-Id: I02579d25e7117053d6d20781ae75c64fdb76b88d
parents 6202d110 6fb68bb1

libziparchive/zip_archive.cc

+6 −1
Original line number Diff line number Diff line
@@ -269,9 +269,14 @@ static int32_t MapCentralDirectory0(int fd, const char* debug_file_name, 
   * Grab the CD offset and size, and the number of entries in the

   * archive and verify that they look reasonable.

   */

  if (eocd->cd_start_offset + eocd->cd_size > eocd_offset) {

  if (static_cast<off64_t>(eocd->cd_start_offset) + eocd->cd_size > eocd_offset) {

    ALOGW("Zip: bad offsets (dir %" PRIu32 ", size %" PRIu32 ", eocd %" PRId64 ")",

        eocd->cd_start_offset, eocd->cd_size, static_cast<int64_t>(eocd_offset));

#if defined(__ANDROID__)

    if (eocd->cd_start_offset + eocd->cd_size <= eocd_offset) {

      android_errorWriteLog(0x534e4554, "31251826");

    }

#endif

    return kInvalidOffset;

  }

  if (eocd->num_records == 0) {